We claim: 



1. A streaming media player providing content protection and digital rights 
management, including: 

a port configured to receive a digital bit stream, the digital bit stream including: 
content which is encrypted at least in part, and 

a secure container including control information for controlling use of the 
content, including at least one key suitable for decryption of at least a portion of the 
content; and 

a control arrangement including: 

means for opening secure containers and extracting cryptographic keys, and 
means for decrypting the encrypted portion of the content. 

2. The player of Claim 1 in which the digital bit stream includes at least two sub- 
streams which have been muxed together, at least one of the sub-streams including 
compressed information, and 

wherein the player further includes: 

a demux designed to separate and route the sub-streams; 

a decompression unit configured to decompress at least one of the sub-streams, the 
decompression unit and the demux being connected by a pathway for the transmission of 
information; and 

a rendering unit designed to process decompressed content information for 
rendering. 

3. The player of Claim 2, further including: 
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a stream controller operatively connected to the decompression unit, the stream 
controller including decryption functionality configured to decrypt at least a portion of a 
sub-stream and pass the decrypted sub-stream to the decompression unit. 

4. The player of Claim 3, further including: 

a path between the control arrangement and the stream controller to enable the 
control arrangement to pass at least one key to the stream controller for use with the stream 
controller's decryption functionality. 

5. The player of Claim 4, further including: 

a feedback path from the rendering unit to the control arrangement to allow the 
control arrangement to receive information from the rendering unit regarding the 
identification of objects which are to be rendered or have been rendered. 

6. The player of Claim 1, wherein the digital bit stream is encoded in MPEG-4 format. 

7. The player of Claim 1 3 wherein the digital bit stream is encoded in MP3 format. 

8. The player of Claim 4, wherein the control arrangement contains a rule or rule set 
associated with governance of at least one sub-stream or object. 

9. The player of Claim 8, wherein the rule or rule set is delivered from an external 
source. 

10. The player of Claim 9, wherein the rule or rule set is delivered as part of the digital 
bit stream. 

1 1 . The player of Claim 8, wherein the rule or rule set specifies conditions under which 
the governed sub-stream or object may be decrypted. 
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12. The player of Claim 8, wherein the rule or rule set governs at least one aspect of 
access to or use of the governed sub-stream or object. 

13. The player of Claim 12, wherein the governed aspect includes making copies of the 
governed sub-stream or object. 

14. The player of Claim 12, wherein the governed aspect includes transmitting the 
governed sub-stream or object through a digital output port. 

15. The player of Claim 14, wherein the rule or rule set specifies that the governed sub- 
stream or object can be transferred to a second device, but rendering of the governed sub- 
stream or object must be disabled in the first device prior to or during the transfer. 

16. The player of Claim 15, wherein the second device includes rendering capability, 
lacks at least one feature present in the streaming media player, and is at least somewhat 
more portable than the streaming media player. 

17. The player of Claim 11, wherein the control arrangement contains at least two rules 
governing access to or use of the same governed sub-stream or object. 

18. The player of Claim 17, wherein a first of the two rules was supplied by a first 
entity, and the second of the two rules was supplied by a second entity. 

19. The player of Claim 18, wherein the first rule controls at least one aspect of 
operation of the second rule. 

20. The player of Claim 12, wherein the governed aspect includes use of at least one 
budget. 

21. The player of Claim 12, wherein the governed aspect includes a requirement that 
audit information be provided. 
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The player of Claim 1 , wherein the control arrangement includes tamper resistance. 
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23. 



A digital bit stream including: 



content information that is compressed and at least in part encrypted; and 

a secure container including 

governance information for the governance of at least one aspect of 
access to or use of at least a portion of the content information; and 

a key for decryption of at least a portion of the encrypted content 
information. 

24. The digital bit stream of Claim 23, wherein the content information is encoded in 
MPEG-4 format. 

25. The digital bit stream of Claim 23, wherein the content information is encoded in 
MP 3 format. 
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A method of rendering a protected digital bit stream including: 

receiving the protected digital bit stream, 

passing the protected digital bit stream to a media player, 

the media player reading first header information identifying a plugin used 
to process the protected digital bit stream, the first header information 
indicating that a first plugin is required; 

the media player calling the first plugin; 

the media player passing the protected digital bit stream to the first plugin; 

the first plugin decrypting at least a portion of the protected digital bit stream; 

the first plugin reading second header information identifying a second plugin 
necessary in order to render the decrypted digital bit stream; 

the first plugin calling the second plugin; 

the first plugin passing the decrypted digital bit stream to the second plugin; 

the second plugin processing the decrypted digital bit stream, the processing 
including decompressing at least a portion of the decrypted digital bit stream; 

the second plugin passing the decrypted and processed digital bit stream to the 
media player; and 

the media player enabling rendering of the decrypted and processed digital bit 
stream, 

whereby the first plugin may be used in an architecture not designed for 
multiple stages of plugin processing. 
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